Topic starter
09/07/2026 3:25 pm
TL;DR: Ransomware recovery often fails first at identity, with more than 78% of human-operated attacks involving domain controller breaches and typical downtime measured in 22 days, according to Commvault. The practical lesson is that data recovery without clean AD and Entra ID restoration leaves organisations locked out of their own environment.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “Ransomware and Hurricanes: The Anatomy of Impact and the Blueprint for Resilience”.
By the numbers:
- More than 78% of human-operated ransomware attacks involve domain controller breaches.
- Average ransomware downtime is 22 days.
Key questions
Q: What fails when ransomware reaches Active Directory or Entra ID?
A: When ransomware reaches identity infrastructure, the failure is not just encryption.
Q: Why do domain controller breaches make ransomware recovery so much worse?
A: Domain controllers are central trust brokers, so when attackers compromise them they can block access, manipulate authentication state, and force administrators into a much larger rebuild.
Q: What are the signs that a recovery program is not ready for a ransomware event?
A: A recovery program is not ready when teams have not practiced the runbook, roles are unclear, and approval delays slow action during a crisis.
Practitioner guidance
- Audit identity recovery dependencies Map every business service that depends on Active Directory or Entra ID authentication, authorisation, and trust relationships so recovery order is explicit before an incident occurs.
- Protect clean identity backups Maintain immutable, air-gapped copies of AD system state and Entra ID configuration so a restore point cannot be altered by the same event that compromised production identity.
- Rehearse full-forest restoration Run recovery drills that rebuild domain controllers, trusts, and cloud identity settings end to end, then validate that access works without cross-contamination or reinfection.
Bottom line: Ransomware recovery often fails first at identity because AD and Entra ID are the systems that make access, trust, and authorisation possible.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:45 pm
Identity resilience is the real recovery control plane: ransomware recovery fails when organisations treat data restoration as the finish line. If Active Directory or Entra ID is compromised, authentication and authorisation cannot be re-established cleanly, so the business remains functionally locked out even when storage is available. The practitioner conclusion is simple: identity state has to be restored as deliberately as data state.
A question worth separating out:
Q: Should organisations prioritise identity restoration before data restoration after ransomware?
A: Yes, because identity is what makes restored data usable. If Active Directory or Entra ID remains untrusted, the organisation may recover files but still be unable to authenticate users, validate services, or re-establish access across systems. Identity recovery has to come first in the recovery sequence.
👉 Read our full editorial: Identity resilience for ransomware depends on AD and Entra recovery